Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 09:52
General
-
Target
2024-02-24_dae9cb206753ee1691649c19965d7e2c_cryptolocker.exe
-
Size
60KB
-
MD5
dae9cb206753ee1691649c19965d7e2c
-
SHA1
f01ed496a0195092032353c47bb607e11e4217a6
-
SHA256
c0ea8f8081447c5af365dcd50cd563c5f4c68d410217fcd7a03d5c2025aa2292
-
SHA512
5cb2b5d21648420e50dd9b04ad890091ed78d1e6fc6238090fc6b72e3880f4fd611313619e759d78d567092688cdbfa4230f525646facecfc7b68c98ccd86845
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIM:TCjsIOtEvwDpj5HE/OUHnSM+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_dae9cb206753ee1691649c19965d7e2c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_dae9cb206753ee1691649c19965d7e2c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5fc888119cee2a6c96d1051aa56e3e03f
SHA1eb373deab35eca934eb16a8c0d6c6aa9ed9b1320
SHA25646569dbb7996f748015f258bce23e195d5ffb3ca87342fc9d2136de4162a46d8
SHA5121b5e5594af98c0299e4fb213d24552ed2c8997e5aa429818130750279195495a2dd61b6bb64ce72817d1eee865865f46b0234832b04dde114e27b470b462704e
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB